To: 


Of: 


ICO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


UK Appliance Cover Limited 


Custom House, Station Road, Upminster, RM14 2SU 


The Information Commissioner (“the Commissioner”) has decided to 
issue UK Appliance Cover Limited (‘“UKACL”) with a monetary penalty 
under section 55A of the Data Protection Act 1998 (“DPA”). The penalty 
is in relation to a serious contravention of regulations 21 and 24 of the 
Privacy and Electronic Communications (EC Directive) Regulations 2003 
(“PECR"). 


This notice explains the Commissioner's decision. 


Legal framework 


UKACL, whose registered office is given above (Companies House 
Registration Number: 12268294) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 


Regulation 21 applies to the making of unsolicited calls for direct 


marketing purposes. It means that if a company wants to make calls 
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promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have notified the company that they 


do not object to receiving such calls from it. 

Regulation 21 paragraph (1) of PECR provides that: 

"(1) A person shall neither use, nor instigate the use of, a public 

electronic communications service for the purposes of making 

unsolicited calls for direct marketing purposes where- 

(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 


Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


"(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 


(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 


a caller that he does not, for the time being, object to such calls 
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being made on that line by that caller, such calls may be made by 


that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 
any time, and 
(b) where such notification is withdrawn, the caller shall not 


make such calls on that line.” 
fe Regulation 24 of PECR provides: 


"(1) Where a public electronic communications service is used for the 
transmission of a communication for direct marketing purposes 
the person using, or instigating the use of, the service shall 
ensure that the following information is provided with that 


communication - 


(b) in relation to a communication to which regulation 21 
[or 21A] (telephone calls) applies, the particulars 
mentioned in paragraph (2)(a) and, if the recipient of 
the call so requests, those mentioned in paragraph 


(2)(b). 


(2) The particulars referred to in paragraph (1) are - 


(a) the name of the person; 
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(b) either the address of the person or a telephone 


number on which he can be reached free of charge.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The Telephone Preference 
Service Limited (“TPS”) is a limited company which operates the 
register on the Commissioner’s behalf. Businesses who wish to carry 
out direct marketing by telephone can subscribe to the TPS for a fee 


and receive from them monthly a list of numbers on that register. 


Section 122(5) of the DPA18 defines direct marketing as “the 
communication (by whatever means) of advertising or marketing 
material which is directed to particular individuals”. This definition also 
applies for the purposes of PECR (see regulation 2(2) PECR & Schedule 
19 paragraphs 430 & 432(6) DPA18). 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 


“(1) The Commissioner may serve a person with a monetary penalty if 
the Commissioner is satisfied that - 
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(a) there has been a serious contravention of the requirements 


of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 
(a) knew or ought to have known that there was a risk that 
the contravention would occur, but 
(b) failed to take reasonable steps to prevent the 


contravention. 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 
The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 


Schedule 20 to the DPA18. 


Background to the case 
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UKACL first came to the attention of the Commissioner in August 2020 


following a complaint to the TPS about an unsolicited direct marketing 


call from a particular Calling Line Identifier (“CLI”). 


The Commissioner sent a Third-Party Information Notice (“3PIN”) to 
the Communications Service Provider (“CSP”), i’ 
<7 for the CLI in question on 19 August 2020 requesting the 
identity of the CLI’s subscriber. The response, which was received on 
20 August 2020, identified the subscriber as UKACL, and provided a list 
of CLI’s allocated to UKACL with the respective connection dates for 


those. 


The Commissioner conducted a search for complaints to the TPS or the 
Commissioner’s own online reporting tool (“OLRT”) and found that 
there had been two complaints to the TPS. The complaints received in 


relation to calls from the CLI’s stated: 


collecting a payment [sic] of £398 for 3 years warranty on a tv worth 
£30. I said my dementia isolating 89 yo [sic] aunt did not want the 
service, they said there was a cancellation fee. i said send the 
documents and i will get legal advice, they said that would cost me in 
the long run, i said do they want my details , and they rang Off. 

Several subsequent calls have rung off when I answered. 09.16 24th 
July 2020 15.55 21st July 2020 . They are obviously targeting my 
dementia 89 yo [sic] aunt. They tried to frighten me (and my aunt if 
she had answered) into paying a ridiculous sum for a warranty that had 


no economic sense. 


The caller was threatening and coercive and put me ina very difficult 


situation which I am now having to try and get out of 
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The Commissioner sent an initial investigation letter by post and e-mail 
to UKACL on 2 September 2020, setting out her concerns with UKACL’s 
PECR compliance and asking for details of call volumes and information 


relating to its direct marketing activity. 


The Commissioner received no response to this letter, or to the chaser 
letter which was sent on the 7 October 2020. On 26 November 2020 

the Commissioner sent a second chaser via special delivery to UKACL’s 
registered office address requesting a response within seven days. This 
was signed for the following day by ‘Sutton’, however, no response was 


received. 


Resultantly, the Commissioner proceeded to serve an Information 
Notice on UKACL on 26 November 2020 requesting information deemed 
necessary for the purpose of determining UKACL’s compliance with 
PECR. The information requested included the trading names used 
during calls, volume of calls made by UKACL between 1 April 2020 to 
31 August 2020, and the number of those calls which connected with a 
subscriber; evidence that subscribers did not object to the receiving 
calls in relation to the complaints which had been received by the; and 
confirmation of any TPS screening carried out by the organisation. 
Despite the notice being posted via special delivery to UKACL’s 
registered office address and signed for on 27 November 2020 by 


‘Sutton’ no response was received. 


A further 3PIN was sent by the Commissioner to GE on 5 January 
2021 to obtain a copy of UKACL’s Call Detail Records (“CDR’s”) for the 
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CLI’s attributed to UKACL between 1 June 2020 and 31 December 
2020. These were provided by MJ on 7 January 2021. 


The Commissioner subsequently screened the CDR’s against the TPS 
register to establish whether any further calls had been made to TPS 
registered numbers. Results showed that a total of 39,167 calls had 
been made to telephone numbers which had been registered with the 
TPS for not less than 28 days. Out of a total number of 47,461 
telephone calls made, this equated to 82.5% of connected outbound 


calls made during the period. 


The Commissioner wrote again to UKACL by e-mail on 7 January 2020 
explaining that failure to comply with the served Information Notice 
was a criminal offence and requiring them to contact the Commissioner 
within seven days. On the same day a Mr Sutton responded to the e- 
mail. He explained that he had not been in the office since March 2020 
due to the Covid-19 pandemic and was unable to answer the 
Commissioner’s questions in full as he did not have the relevant 
information available. He asked for more time to respond as a result. 
He advised that UKACL was ‘about to fold’. The Commissioner queried 
how the previous correspondence had been signed for at the registered 


office and were told that the office is a serviced building. 


Due to government imposed restrictions the Commissioner informed 
UKACL on 1 February 2021 that the investigation had been placed on 
hold temporarily. Following the easing of restrictions, the investigation 
was resumed on 7 April 2021 with the Commissioner e-mailing UKACL 
requesting again that the Information Notice be responded to within 14 
days. A further copy of the Notice was provided, however, UKACL again 
failed to respond. 
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The Commissioner sent a final chaser on 27 April 2021 indicating that if 

UKACL failed to respond that the matter would be considered for 

prosecution for failure to comply. Mr Sutton responded on 4 May 2021 

to explain again that UKACL was in the process of closing and that no 

more complaints would be received as they had not reopened and did 

not plan to as a result of the pandemic. He also advised that since a lot 


of the accounts have been closed down there was very little 


information that he could provide. 


The Commissioner sent an end of investigation on 3 June 2021 via e- 
mail to UKACL. Having done so the Commissioner carried out further 
checks for additional complaints against UCKACL’s CLI’s and identified 


a further seven including the following: 


Very pushy saying that I had taken out a TV aerial insurance with them 
and wanting to update payment information. Which I haven't. After I 
hung up they phoned back repeatedly until I blocked the number. They 
were very pushy, wouldn't listen and clearly were just after my bank 


details. I was so concerned I phone my banks fraud team after. 


cold call - to persuade an elderly vulnerable person with old age 
memory loss to take out unneeded insurance on equipment - and then 
immediately debit her account. my mother in law (call recipient) is 
unable to arrange her own affairs, the attitude when we called to insist 


the transaction was cancelled was quite rude [sic]. 


It has made me really ill, they keep calling and have taken money from 


me. Iam an elderly woman 


The call was a scam - they asked for credit card details and became 


incredibly rude when I started questioning them 
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It was noted by the Commissioner that the complaints received 
appeared to name another organisation other the UKACL. The 
Commissioner contacted J on 4 June 2021 to make enquiries and 
was informed by return that the CLI’s and CDR’s in question were 


allocated to UKACL. UKACL had failed to address this in its responses to 


the Commissioner but acknowledged the complaints. 


In respect of the 39,167 unsolicited direct marketing calls attributed to 
it, UKACL has to date not evidenced that the subscribers receiving 


them had not objected to receiving its direct marketing calls. 


The Commissioner is satisfied that the 39,167 calls were all made for 


the purposes of direct marketing as defined by section 122(5) DPA18. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulations 21 and 24 of PECR by UKACL and, if so, 


whether the conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that UKACL contravened regulations 21 and 24 
of PECR. 


The Commissioner finds that the contravention was as follows: 


Between 1 June 2020 and 31 December 2020, UKACL used a public 
telecommunications service for the purposes of making 39,167 


unsolicited calls for direct marketing purposes to subscribers where the 
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number allocated to the subscriber in respect of the called line was a 
number listed on the register of numbers kept by the Commissioner in 


accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these 39,167 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 
receiving the calls, and who for the purposes of regulation 21(4) had 


not notified UKACL that they did not object to receiving such calls 


For such notification to be valid under regulation 21(4), the individual 
must have taken a clear and positive action to override their TPS 
registration and indicate their willingness to receive marketing calls 
from the company. The notification should reflect the individual’s 
choice about whether or not they are willing to receive marketing calls. 
Therefore, where signing up to use a product or service is conditional 
upon receiving marketing calls, companies will need to demonstrate 
how this constitutes a clear and positive notification of the individual’s 


willingness to receive such calls. 


The notification must clearly indicate the individual’s willingness to 
receive marketing calls specifically. Companies cannot rely on 
individuals opting in to marketing communications generally, unless it 


is clear that this will include telephone calls. 


Further, the notification must demonstrate the individual’s willingness 
to receive marketing calls from that company specifically. Notifications 
will not be valid for the purposes of regulation 21(4) if individuals are 
asked to agree to receive marketing calls from “similar organisations”, 


WON 


“partners”, “selected third parties” or other similar generic descriptions. 
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UKACL has failed to provide any evidence to the Commissioner that the 


subscribers who received these calls had notified UKACL that they did 


not, for the time being, object to such calls. 


Further, as the complaints indicate, UKACL failed, as required by 
regulation 24 of PECR, to provide the recipient of the calls with the 
particulars specified at regulation 24(2) of PECR in that there is 
evidence that the calls did not accurately identify UKACL as the caller. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of regulations 21 and 24 by UKACL arising from the organisation’s 
activities between 1 June 2020 and 31 December 2020, and this led to 
39,167 unsolicited direct marketing calls being made to subscribers 
who were registered with the TPS and who had not notified UKACL that 


they were willing to receive such calls. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 
above was deliberate. In the Commissioner’s view, this means that 


UKACL’s actions which constituted that contravention were deliberate 
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actions (even if UKACL did not actually intend thereby to contravene 
PECR). 


The Commissioner does not consider that UKACL deliberately set out to 


contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, he has considered whether UKACL knew or ought reasonably to 
have known that there was a risk that this contravention would occur. 


He is satisfied that this condition is met. 


The Commissioner has published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
any subscriber registered with the TPS, unless the subscriber has 
specifically notified the company that they do not object to receiving 
such calls. In case organisations remain unclear on their obligations, 
the ICO operates a telephone helpline. ICO communications about 
previous enforcement action where businesses have not complied with 


PECR are also readily available 


Standard practice of the TPS is to contact the organisation making the 
calls on each occasion a complaint is made. It is therefore reasonable 
to believe that UKACL would have received a notification from the TPS 


for each of the complaints being made in this case. That there were 
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complaints made to the TPS should have made UKACL aware of the risk 


that such contraventions may occur and were indeed occurring. 


It is therefore reasonable to suppose that UKACL should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether UKACL 
failed to take reasonable steps to prevent the contravention. Again, he 


is satisfied that this condition is met. 


In this case UKACL have provided no information to the Commissioner 
to assist her investigation and seemingly took no steps to ensure that 
the data it used was screened against the TPS every 28 days as 
requested. This is evident from the very high percentage of calls made 
to TPS registered telephone numbers. This is a basic requirement for 
any organisation conducting a live marketing campaign. Screening 
numbers against the TPS register would have reduced, if not eliminated 
the likelihood of TPS registered numbers being included in UKACL’s 


marketing lists. 


Reasonable steps in these circumstances may also have included 
conducting thorough checks on all of the data it was to use for its 
direct marketing campaigns; or at least obtaining and recording 
evidence of notification from those TPS-registered individuals whom 
had indicated that they did not object to receiving marketing calls from 
UKACL. 


Given the volume of calls and complaints, it is clear that UKACL failed 


to take those reasonable steps. 
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The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner’s decision to issue a monetary penalt 


The Commissioner has taken into account the following aggravating 


features of this case: 


The complaints received suggest that there was targeting of vulnerable 
individuals for financial gain with no evidence to indicate that the 
services advertised were ultimately being provided. The calls also 


appeared to be aggressive in nature; 


The actions of UKACL were carried out to generate business and to 
increase profits, gaining an unfair advantage on those businesses 


complying with PECR; 


Despite a limited acknowledgement of the Commissioner’s 
correspondence, UKACL failed to co-operate with the Commissioner. This 
resulted in her issuing a formal Information Notice. Despite this being 
issued, UKACL still failed to provide a substantive response to her 


enquiries. 


The Commissioner does not consider there to be any mitigating 


features in this case. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. He is 
also satisfied that the procedural rights under section 55B have been 


complied with. 
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The latter has included the issuing of a Notice of Intent, in which the 


Commissioner set out his preliminary thinking. The Commissioner has 


not received any representations from UKACL in response . 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, he 


should exercise his discretion so as to issue a monetary penalty. 


The Commissioner has attempted to consider the likely impact of a 
monetary penalty on UKACL but has been unable to do so given the 
lack of recent publicly available information. UKACL was invited to 
provide financial representations in response to the Notice of Intent, 
but failed to do so. The Commissioner considers in the circumstances 


that a penalty remains the appropriate course of action. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 
telephoning consumers who are not registered with the TPS and/or 


specifically indicate that they do not object to receiving these calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 
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Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £100,000 (one hundred thousand 
pounds) is reasonable and proportionate given the particular facts of 


the case and the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 13 April 2022 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
12 April 2022 the Commissioner will reduce the monetary penalty by 
20% to £80,000 (Eighty thousand pounds). However, you should 

be aware that the early payment discount is not available if you decide 


to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 
against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
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Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 14 day of March 2022. 


Andy Curry 

Head of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2; If you decide to appeal and if the Tribunal considers:- 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that he ought to have exercised 


his discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 
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Telephone: 0203 936 8963 


Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5. Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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